GVU Trojaner auf meinem Windows 7 64 Bit System

Ronily · 01.08.2013, 10:06

Hallo, ich habe bei euch Hinweise auf den GVU Trojaner gefunden, mit dem ich mich leider infiziert habe. Ich habe bereits per USB Stick die FRST Datei heruntergeladen und auf meinem Rechner aufgespielt. (64 Bit Version) Windows 7. Hier der FRST. text von meinem PC

Ich hoffe ihr könnt mir helfen
Gruß

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03
Ran by SYSTEM on 01-08-2013 10:45:21
Running from H:\
Windows 7 Professional (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8116256 2009-09-22] (Realtek Semiconductor)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1281512 2013-01-27] (Microsoft Corporation)
HKLM-x32\...\Run: [] -  [x]
HKU\Ronald\...\Run: [TrueCrypt] - C:\Program Files (x86)\TrueCrypt\TrueCrypt.exe [1415632 2009-12-21] (TrueCrypt Foundation)
HKU\Ronald\...\Run: [] -  [x]
HKU\Ronald\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKU\Ronald\...\Winlogon: [Shell] explorer.exe,C:\Users\Ronald\AppData\Roaming\cache.dat [61952 2011-11-17] () <==== ATTENTION 
AppInit_DLLs: acaptuser64.dll [119160 2008-06-11] (Adobe Systems, Inc.)
AppInit_DLLs-x32: acaptuser32.dll [111992 2008-06-11] (Adobe Systems, Inc.)

==================== Services (Whitelisted) =================

S2 DES2 Service; C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [68136 2009-06-17] ()
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)
S3 ANIWZCSdService; C:\Program Files (x86)\ANI\ANIWZCS2 Service\ANIWZCSdS.exe [x]
S2 HitmanPro37CrusaderBoot; "F:\Users\Ronald\Downloads\HitmanPro_x64.exe" /crusader:boot [x]

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-12-25] ()
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
S3 etdrv; C:\Windows\etdrv.sys [25640 2009-12-22] (Windows (R) Server 2003 DDK provider)
S3 etdrv; C:\Windows\etdrv.sys [25640 2009-12-22] (Windows (R) Server 2003 DDK provider)
S3 gdrv; C:\Windows\gdrv.sys [25640 2013-08-01] (Windows (R) Server 2003 DDK provider)
S3 gdrv; C:\Windows\gdrv.sys [25640 2013-08-01] (Windows (R) Server 2003 DDK provider)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2009-12-28] ()
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2009-12-28] ()
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-12-25] ()
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)
S3 rt2870; C:\Windows\System32\DRIVERS\rt2870.sys [941056 2009-04-15] (Ralink Technology, Corp.)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2009-12-21] (Duplex Secure Ltd.)
S1 truecrypt; C:\Windows\SysWow64\drivers\truecrypt.sys [222160 2009-12-21] (TrueCrypt Foundation)
S1 truecrypt; C:\Windows\SysWow64\drivers\truecrypt.sys [222160 2009-12-21] (TrueCrypt Foundation)
S3 AODDriver; \??\C:\Program Files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys [x]
S3 cpuz130; \??\C:\Users\Anwender\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]
S3 EverestDriver; \??\C:\inst\EverestUltimate5301900\EverestUltimate\kerneld.amd64 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-01 10:45 - 2013-08-01 10:45 - 00000000 ____D C:\FRST
2013-07-30 14:47 - 2013-07-30 23:51 - 00000004 _____ C:\Users\Ronald\AppData\Roaming\cache.ini
2013-07-27 12:09 - 2013-07-27 12:09 - 00000000 ____D C:\Users\Ronald\Desktop\Schneemann
2013-07-27 12:09 - 2013-07-27 12:09 - 00000000 ____D C:\Users\Ronald\Desktop\Der Erlo╠êser

==================== One Month Modified Files and Folders =======

2013-08-01 09:24 - 2009-12-22 21:07 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2013-08-01 09:24 - 2009-12-21 14:15 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-01 09:24 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-01 09:24 - 2009-07-14 05:51 - 00186228 _____ C:\Windows\setupact.log
2013-07-30 23:51 - 2013-07-30 14:47 - 00000004 _____ C:\Users\Ronald\AppData\Roaming\cache.ini
2013-07-30 20:36 - 2009-12-21 19:27 - 01380564 _____ C:\Windows\WindowsUpdate.log
2013-07-30 20:31 - 2009-07-14 05:45 - 00020304 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-30 20:31 - 2009-07-14 05:45 - 00020304 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-30 20:30 - 2009-07-14 18:58 - 00653402 _____ C:\Windows\System32\perfh007.dat
2013-07-30 20:30 - 2009-07-14 18:58 - 00130022 _____ C:\Windows\System32\perfc007.dat
2013-07-30 20:30 - 2009-07-14 06:13 - 01497992 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-30 18:21 - 2013-01-28 15:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-30 14:13 - 2009-12-27 18:34 - 00000000 ____D C:\Program Files (x86)\Runes of Magic
2013-07-29 10:36 - 2012-08-06 17:22 - 00000000 ____D C:\Users\Ronald\Desktop\EKST
2013-07-27 12:10 - 2011-06-26 18:36 - 00525824 ___SH C:\Users\Ronald\Desktop\Thumbs.db
2013-07-27 12:09 - 2013-07-27 12:09 - 00000000 ____D C:\Users\Ronald\Desktop\Schneemann
2013-07-27 12:09 - 2013-07-27 12:09 - 00000000 ____D C:\Users\Ronald\Desktop\Der Erlo╠êser
2013-07-27 12:09 - 2013-06-26 17:41 - 00000000 ____D C:\Users\Ronald\Desktop\__MACOSX
2013-07-26 09:43 - 2009-12-21 14:24 - 00006162 _____ C:\Windows\PFRO.log
2013-07-26 08:42 - 2011-10-24 09:15 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-07-26 08:39 - 2012-08-06 15:33 - 00000000 ____D C:\Users\Ronald\AppData\Local\.elfohilfe
2013-07-26 08:37 - 2009-12-21 23:58 - 00000000 ____D C:\users\Ronald
2013-07-22 11:51 - 2009-12-23 14:19 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-22 11:51 - 2009-12-21 15:45 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe

ZeroAccess:
C:\Users\Ronald\AppData\Local\{91d0d802-296e-41a5-217e-c568205d9c42}

Files to move or delete:
====================
C:\Users\Ronald\AppData\Roaming\skype.ini
C:\Users\Ronald\AppData\Roaming\cache.dat
C:\Users\Ronald\AppData\Roaming\cache.ini

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================


==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 4091.48 MB
Available physical RAM: 3468.36 MB
Total Pagefile: 4089.63 MB
Available Pagefile: 3459.47 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (Windows 7) (Fixed) (Total:195.21 GB) (Free:117.24 GB) NTFS (Disk=0 Partition=2)
Drive g: (Anno 1404 Add-On) (CDROM) (Total:0.77 GB) (Free:0 GB) CDFS
Drive h: (USB 1 GB) (Removable) (Total:0.93 GB) (Free:0.66 GB) FAT (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 5F963CEE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=736 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 953 MB) (Disk ID: 440F0626)
Partition 1: (Active) - (Size=953 MB) - (Type=06)


LastRegBack: 2013-06-03 18:31

==================== End Of Log ============================

M-K-D-B · 01.08.2013, 10:08

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 5 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!
Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Ich habe dein Thema in Arbeit und melde mich so schnell wie möglich mit weiteren Anweisungen.

M-K-D-B · 01.08.2013, 10:10

Servus,

Zuerst müssen wir auf einem sauberen Rechner den Fix erstellen. Das geht so:
Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
HKU\Ronald\...\Winlogon: [Shell] explorer.exe,C:\Users\Ronald\AppData\Roaming\cache.dat [61952 2011-11-17] () <==== ATTENTION 
C:\Users\Ronald\AppData\Roaming\cache.dat
C:\Users\Ronald\AppData\Roaming\cache.ini
C:\Users\Ronald\AppData\Local\{91d0d802-296e-41a5-217e-c568205d9c42}
C:\Users\Ronald\AppData\Roaming\skype.ini
end

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Bitte berichte mir, ob du deinen Rechner danach wieder normal starten kannst.
Dann geht es weiter.

Ronily · 01.08.2013, 10:30

Hallo,
juhuuuu es klappt, ich hab den trojaner nicht mehr. Vielen Dank.
War meine Vermutung richtig mit dem GVU Trojaner?
Kann es sein das avira per Recovery den Trojaner nicht findet?

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 30-07-2013 03
Ran by SYSTEM at 2013-08-01 11:23:21 Run:1
Running from H:\
Boot Mode: Recovery
==============================================

HKU\Ronald\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\Users\Ronald\AppData\Roaming\cache.dat => Moved successfully.
C:\Users\Ronald\AppData\Roaming\cache.ini => Moved successfully.
C:\Users\Ronald\AppData\Local\{91d0d802-296e-41a5-217e-c568205d9c42} => Moved successfully.
C:\Users\Ronald\AppData\Roaming\skype.ini => Moved successfully.

==== End of Fixlog ====

M-K-D-B · 01.08.2013, 11:36

Servus,

Zitat:

Zitat von Ronily

War meine Vermutung richtig mit dem GVU Trojaner?
Kann es sein das avira per Recovery den Trojaner nicht findet?

Ja, deine Vermutung war richtig. Allerdings tummelte sich da noch was andres rum. Daher müssen wir deinen Rechner nochmal genauer ansehen.
Gut möglich, dass Avira den Trojaner nicht erkennt.

Führe nun FRST im normalen Modus vom Desktop aus:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Ronily · 02.08.2013, 17:23

Hallo,
anliegend der Bericht. Ich habe gestern noch das SP1 für Wind. 7 installiert (der autoinstaller wollte nicht) daher ist der Bericht etwas gekürzt um die Microfoft eintragungen.
Was tummelt sich den da eventuell noch?

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03
Ran by Ronald (administrator) on 02-08-2013 18:02:20
Running from C:\Users\Ronald\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
() C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(TrueCrypt Foundation) C:\Program Files (x86)\TrueCrypt\TrueCrypt.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8116256 2009-09-22] (Realtek Semiconductor)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKCU\...\Run: [TrueCrypt] - C:\Program Files (x86)\TrueCrypt\TrueCrypt.exe [1415632 2009-12-22] (TrueCrypt Foundation)
HKCU\...\Run: [] -  [x]
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKCR\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\Ronald\AppData\Local\{91d0d802-296e-41a5-217e-c568205d9c42}\n. ATTENTION! ====> ZeroAccess?
MountPoints2: {07545f48-ee5e-11de-9eb2-806e6f6e6963} - D:\Autorun.exe
MountPoints2: {3f49a061-ee58-11de-9b13-6cf04902bbd0} - E:\Autorun.exe
HKLM-x32\...\Run: [] -  [x]
AppInit_DLLs: acaptuser64.dll [119160 2008-06-12] (Adobe Systems, Inc.)
AppInit_DLLs-x32: acaptuser32.dll [111992 2008-06-12] (Adobe Systems, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.onvista.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {B337ADB0-1B49-4F54-BF93-D1F9288F45FC} URL = hxxp://start.funmoods.com/results.php?f=4&a=ddrnw&q={searchTerms}
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKCU - {B337ADB0-1B49-4F54-BF93-D1F9288F45FC} URL = hxxp://start.funmoods.com/results.php?f=4&a=ddrnw&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\dbtxid07.default
FF user.js: detected! => C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\dbtxid07.default\user.js
FF Homepage: hxxp://www.onvista.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=1.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF Plugin HKCU: @eximion.com/KalydoPlayer - C:\Users\Ronald\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll (Eximion B.V.)
FF SearchPlugin: C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\dbtxid07.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\dbtxid07.default\searchplugins\delta.xml
FF Extension: No Name - C:\Users\Ronald\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Ghostery - C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\dbtxid07.default\Extensions\firefox@ghostery.com
FF Extension: WOT - C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\dbtxid07.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: DownloadHelper - C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\dbtxid07.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: No Name - C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\dbtxid07.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\dbtxid07.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Ronald\AppData\Roaming\Mozilla\Firefox\Profiles\dbtxid07.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: No Name - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [fdloijijlkoblmigdofommgnheckmaki] - C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx

==================== Services (Whitelisted) =================

R2 DES2 Service; C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [68136 2009-06-17] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
S3 ANIWZCSdService; C:\Program Files (x86)\ANI\ANIWZCS2 Service\ANIWZCSdS.exe [x]

==================== Drivers (Whitelisted) ====================

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-12-25] ()
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
S3 etdrv; C:\Windows\etdrv.sys [25640 2009-12-22] (Windows (R) Server 2003 DDK provider)
S3 etdrv; C:\Windows\etdrv.sys [25640 2009-12-22] (Windows (R) Server 2003 DDK provider)
R3 gdrv; C:\Windows\gdrv.sys [25640 2013-08-02] (Windows (R) Server 2003 DDK provider)
R3 gdrv; C:\Windows\gdrv.sys [25640 2013-08-02] (Windows (R) Server 2003 DDK provider)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2009-12-28] ()
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2009-12-28] ()
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-12-25] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S3 rt2870; C:\Windows\System32\DRIVERS\rt2870.sys [941056 2009-04-15] (Ralink Technology, Corp.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2009-12-21] ()
R1 truecrypt; C:\Windows\SysWow64\drivers\truecrypt.sys [222160 2009-12-22] (TrueCrypt Foundation)
R1 truecrypt; C:\Windows\SysWow64\drivers\truecrypt.sys [222160 2009-12-22] (TrueCrypt Foundation)
U3 arxj1oju; C:\Windows\System32\Drivers\arxj1oju.sys [0 ] (Microsoft Corporation)
S3 AODDriver; \??\C:\Program Files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys [x]
S3 cpuz130; \??\C:\Users\Anwender\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]
S3 EverestDriver; \??\C:\inst\EverestUltimate5301900\EverestUltimate\kerneld.amd64 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========




2013-08-01 21:25 - 2013-08-01 21:25 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-01 21:25 - 2013-08-01 21:25 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-08-01 21:25 - 2013-08-01 21:25 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-01 20:36 - 2013-08-01 20:36 - 00000000 ____D C:\Windows\system32\MRT
2013-08-01 20:28 - 2013-08-01 20:28 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-01 20:28 - 2013-08-01 20:28 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-08-01 20:28 - 2013-08-01 20:28 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-01 20:28 - 2013-08-01 20:28 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-01 20:28 - 2013-08-01 20:28 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-01 20:28 - 2013-08-01 20:28 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-08-01 20:28 - 2013-08-01 20:28 - 00000000 ____D C:\Program Files\Java
2013-08-01 18:12 - 2013-08-01 18:12 - 01781589 _____ (Farbar) C:\Users\Ronald\Desktop\FRST64.exe
2013-08-01 11:45 - 2013-08-01 11:45 - 00000000 ____D C:\FRST


==================== One Month Modified Files and Folders =======

2013-08-02 18:01 - 2009-07-14 19:58 - 00653402 _____ C:\Windows\system32\perfh007.dat
2013-08-02 18:01 - 2009-07-14 19:58 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-08-02 18:01 - 2009-07-14 07:13 - 01497992 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-02 17:55 - 2009-12-22 22:07 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2013-08-02 17:55 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-02 17:55 - 2009-07-14 06:51 - 00186732 _____ C:\Windows\setupact.log
2013-08-02 11:29 - 2009-12-21 20:27 - 01856285 _____ C:\Windows\WindowsUpdate.log
2013-08-02 10:57 - 2009-07-14 06:45 - 00020304 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-02 10:57 - 2009-07-14 06:45 - 00020304 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-02 10:52 - 2013-01-28 16:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-02 10:49 - 2009-07-14 06:45 - 00418096 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-02 10:25 - 2009-12-22 00:59 - 00000000 ___RD C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-02 10:25 - 2009-12-22 00:59 - 00000000 ___RD C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-08-02 10:25 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-08-01 23:56 - 2009-12-21 15:24 - 00011090 _____ C:\Windows\PFRO.log
2013-08-01 23:50 - 2009-07-14 20:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-08-01 23:50 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-08-01 23:50 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-08-01 23:50 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-08-01 23:50 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-01 23:50 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-08-01 23:50 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-08-01 23:50 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-08-01 23:50 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\sppui
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Setup
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\manifeststore
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\AdvancedInstallers
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\sppui
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Setup
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\oobe
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\manifeststore
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Dism
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\servicing
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-08-01 23:50 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-08-01 23:39 - 2009-07-14 04:36 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\msclmd.dll
2013-08-01 23:39 - 2009-07-14 04:36 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msclmd.dll
2013-08-01 23:31 - 2013-08-01 23:31 - 00000000 ____D C:\Windows\system32\SPReview
2013-08-01 23:30 - 2013-08-01 23:30 - 00000000 ____D C:\Windows\system32\EventProviders
2013-08-01 22:53 - 2013-08-01 22:53 - 00000000 ____D C:\Windows\CheckSur
2013-08-01 22:52 - 2009-12-21 14:57 - 00000000 ____D C:\inst
2013-08-01 21:39 - 2009-12-22 00:59 - 00001452 _____ C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-01 21:39 - 2009-12-22 00:59 - 00001418 _____ C:\Users\Ronald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-08-01 21:38 - 2012-05-15 14:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-01 21:26 - 2011-06-14 15:03 - 00006894 _____ C:\Windows\IE9_main.log
2013-08-01 21:25 - 2013-08-01 21:25 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 03695416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-08-01 21:25 - 2013-08-01 21:25 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-01 21:25 - 2013-08-01 21:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-01 21:25 - 2013-08-01 21:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-01 21:25 - 2013-08-01 21:25 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-01 21:25 - 2013-08-01 21:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-01 21:25 - 2013-08-01 21:25 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-01 21:25 - 2013-08-01 21:25 - 00434176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00403248 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-01 21:25 - 2013-08-01 21:25 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00353584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00203776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-01 21:25 - 2013-08-01 21:25 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-08-01 21:25 - 2013-08-01 21:25 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-01 21:25 - 2013-08-01 21:25 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-01 21:25 - 2013-08-01 21:25 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-01 21:22 - 2011-06-26 19:36 - 00525824 ___SH C:\Users\Ronald\Desktop\Thumbs.db
2013-08-01 21:22 - 2011-01-31 13:36 - 00002155 _____ C:\Windows\epplauncher.mif
2013-08-01 21:22 - 2011-01-31 13:35 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-08-01 21:22 - 2011-01-31 13:35 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-08-01 20:39 - 2013-08-01 20:36 - 00000000 ____D C:\Windows\system32\MRT
2013-08-01 20:29 - 2013-01-28 16:03 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-01 20:29 - 2013-01-28 16:03 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-01 20:29 - 2011-06-14 09:29 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-01 20:28 - 2013-08-01 20:28 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-01 20:28 - 2013-08-01 20:28 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-08-01 20:28 - 2013-08-01 20:28 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-01 20:28 - 2013-08-01 20:28 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-01 20:28 - 2013-08-01 20:28 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-01 20:28 - 2013-08-01 20:28 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-08-01 20:28 - 2013-08-01 20:28 - 00000000 ____D C:\Program Files\Java
2013-08-01 20:28 - 2012-11-25 14:52 - 00000000 ____D C:\Program Files\CCleaner
2013-08-01 20:21 - 2011-06-26 18:59 - 00000000 ____D C:\Users\Ronald\AppData\Roaming\Skype
2013-08-01 20:21 - 2009-12-22 00:05 - 00000000 ____D C:\ProgramData\Skype
2013-08-01 20:21 - 2009-12-21 20:08 - 00000000 ____D C:\Windows\system32\appmgmt
2013-08-01 20:21 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-01 20:01 - 2009-12-21 20:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-01 19:26 - 2012-11-25 14:35 - 05487912 _____ (TeamViewer GmbH) C:\Users\Ronald\Desktop\TeamViewer_Setup_de.exe
2013-08-01 18:12 - 2013-08-01 18:12 - 01781589 _____ (Farbar) C:\Users\Ronald\Desktop\FRST64.exe
2013-08-01 17:50 - 2009-12-21 15:15 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-01 13:00 - 2009-12-23 15:15 - 00000000 ____D C:\Users\Ronald\AppData\Roaming\DAEMON Tools Lite
2013-08-01 11:45 - 2013-08-01 11:45 - 00000000 ____D C:\FRST
2013-07-30 15:13 - 2009-12-27 19:34 - 00000000 ____D C:\Program Files (x86)\Runes of Magic
2013-07-29 11:36 - 2012-08-06 18:22 - 00000000 ____D C:\Users\Ronald\Desktop\EKST
2013-07-27 13:21 - 2011-05-08 12:24 - 00000000 ____D F:\Users\Ronald\Documents\Calibre Library
2013-07-27 13:09 - 2013-07-27 13:09 - 00000000 ____D C:\Users\Ronald\Desktop\Schneemann
2013-07-27 13:09 - 2013-07-27 13:09 - 00000000 ____D C:\Users\Ronald\Desktop\Der Erlo╠êser
2013-07-27 13:09 - 2013-06-26 18:41 - 00000000 ____D C:\Users\Ronald\Desktop\__MACOSX
2013-07-26 09:42 - 2011-10-24 10:15 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-07-26 09:39 - 2012-08-06 16:33 - 00000000 ____D C:\Users\Ronald\AppData\Local\.elfohilfe
2013-07-26 09:37 - 2009-12-22 00:58 - 00000000 ____D C:\Users\Ronald
2013-07-22 12:51 - 2009-12-23 15:19 - 00000000 ____D C:\ProgramData\Microsoft Help

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-01 18:11

==================== End Of Log ============================

M-K-D-B · 03.08.2013, 11:04

Servus,

Zitat:

Zitat von Ronily

Was tummelt sich den da eventuell noch?

Überreste von ZeroAccess.

FRST erstellt zwei Logdateien... du hast mir nur eine gepostet. Poste mir bitte die Addition.txt.
Vielen Dank.

M-K-D-B · 07.08.2013, 12:46

Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten.
PM an mich falls Du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen!

GVU Trojaner auf meinem Windows 7 64 Bit System

Log-Analyse und Auswertung: GVU Trojaner auf meinem Windows 7 64 Bit System